Website Privacy for BC Businesses: A Practical PIPA Checklist

If your website has a contact form, a newsletter signup, an online shop or analytics, it collects personal information. In British Columbia, private-sector organisations that do so are covered by the Personal Information Protection Act, or PIPA. It applies to businesses of every size, including sole proprietors and non-profits.

This checklist is a practical overview for website owners. It is not legal advice; the Act itself and the Privacy Commissioner’s guidance are linked at the end.

The idea behind PIPA

PIPA is built on a reasonableness test: collect, use and disclose personal information only for purposes a reasonable person would consider appropriate, tell people what those purposes are, and get their consent. It also expects you to protect what you hold and to let people see and correct their own information.

Your website checklist

• Name a privacy contact. PIPA requires organisations to designate someone responsible for compliance and to make that person’s contact details available.
• Publish a privacy policy written in plain language: what you collect, why, who you share it with (for example your email platform or payment processor), how long you keep it and how to reach you.
• Collect less. Every extra form field is something else to protect. If you do not need a date of birth or a home address, do not ask.
• Explain the purpose at the point of collection. A line under the form such as “We use your details only to reply to your enquiry” goes a long way.
• Keep marketing consent separate. Agreeing to a quote is not agreeing to a newsletter; see our article on CASL email rules.
• Secure the site: HTTPS everywhere, software kept up to date, strong passwords and limited admin access.
• Decide how long you keep enquiries and delete old ones on a schedule.
• Have a simple process for when someone asks what you hold about them.

Cookies and analytics

Canadian law does not have a cookie-banner rule identical to Europe’s, but consent principles still apply, and regulators expect meaningful consent for tracking used for advertising. A sensible approach for a small business: use privacy-respecting analytics settings, do not load advertising trackers you are not using, describe what you do use in your policy, and offer a clear way to opt out. If you have European visitors or customers, European rules may apply to them as well.

Service providers and where data lives

Most small business websites rely on outside services: hosting, form tools, email platforms, booking systems. You remain responsible for personal information you hand to them, so choose reputable providers and read what they do with the data. PIPA does not forbid storing information outside Canada, but being open about it in your policy is good practice, and it is something customers increasingly ask about. Our article on where to host a Canadian website covers the trade-offs.

PIPA, PIPEDA and the US

PIPA covers organisations within British Columbia. The federal law, PIPEDA, applies to federally regulated businesses and generally to personal information that crosses provincial or national borders in the course of commercial activity. If you sell to Californians at scale, California’s privacy law may also be relevant. Most small businesses can meet all of these with one honest policy and careful habits.

Where Cloud9 fits

Cloud9 Web Developments builds websites for British Columbia businesses with privacy considered from the start: minimal forms, secure handling of enquiries and clear consent. We are a web agency, not a law firm, so we work alongside your legal adviser on the wording. Read about our web development service and our website maintenance guide, or get in touch from anywhere in Greater Vancouver.